When we think about surveillance, we tend to forget that many of our normal daily activities, like reading the news online, are recorded and collected for commercial purposes. This is often done without our knowledge or informed consent, and serves as a gold mine for data analysts and the data industry. This industry is opaque, as it is unclear to us which and how many companies are tracking us when we access websites, how our data is handled and who it is subsequently shared with.

Tactical Technology Collective is working to explore and visualise the data industry through Trackography, a new open source tool that reveals which third parties track us and where our data travels to when we access media websites.

When our data travels through the Internet, an international network of networks, it moves through multiple servers around the world. When visiting a website, our data travels to the servers of the website and those of third-party trackers, such as advertisers.

Trackography illustrates that reading the news online is far more political than what we might imagine it to be. According to one Trackography test, when individuals in Ukraine access two national media websites, pravda.com.ua and vesti.ua, their data travels through the network infrastructure of Russia, and they are also tracked by various third party tracking companies, one of which is Yandex, located in Russia. Given the political tension between Russia and Ukraine, the commercial profiling of Ukrainians by a Russian tracking companies can raise questions – especially since the company engages in profiling and third-party sharing, but it remains unclear how long it retains the data, what these profiles are subsequently used for and who has access to them.

The politics of data does not only relate to these counterintuitive geopolitical routes — it can also interfere with legal protections for privacy. While we might access the news online in countries which are known for having strong privacy laws, our data might potentially travel to countries that don't. One of Trackography's tests illustrates that when individuals access national media websites from Germany, their data travels through the network infrastructure of India, which currently has no privacy law. As such, it can be questioned how our data can adequately be safeguarded, given that access to various websites requires it to travel to foreign countries which may have different safeguards – or none at all.

A peek into the data industry

Most webpages we access include embedded images and code which collect and send information about us to the servers of companies. These companies are the “third party trackers” which collect our IP address and track our online activity through the use of browser cookies and other technologies. Often, they also store various tracking technologies on our browser which enable them to track all the other websites we subsequently visit across time. All of this enables them to map out our interests and to create profiles about us.

Trackography illustrates which specific companies track us every time we access a media website. In 37 countries around the world, Trackography tests showed that Google, Facebook and Twitter track online news readers the most.

However, it remains unclear how companies handle the data that they collect. An examination of the privacy policies of some of the globally prevailing tracking companies shows that most of them collect personally identifiable information which they disclose to third parties, without explicitly prohibiting them from using such data for unspecified purposes. It's also noteworthy that most of these companies state in their privacy policies that they retain the data that they collect, but do not specify for how long.

While all this might sound harmless, let's not forget that profiling is at the heart of online tracking. Data collected through online tracking can be aggregated with other data collected from both online and offline sources to create individual profiles. However, we largely cannot control what type of profiles are created about us, whether they are accurate, and who they are subsequently sold to.